01
Shared over chat or by hand
Plaintext lingers in message history, on devices, and in backups — and you can't take it back.
Offline-first secret sharing CLI
Still sharing .env files
over chat or by hand?
Encrypted secrets, reviewed like code.
Kapsaro is a secret-sharing tool for Git/PR-centric teams. It encrypts secrets per member, so you can review who has access and what changed in a pull request — no dedicated server or external SaaS.
brew install ebisawa/kapsaro/kapsaro
Apache-2.0
HPKE
Ed25519 signatures
# 1. Import an existing .env, encrypted
kapsaro import .env
# 2. Review the encrypted diff in a PR
git add . && git commit -m "update secrets"
# 3. Run without writing plaintext
kapsaro run -- npm start01 · The problem
Is the way you share secrets safe?
The states you most want to avoid: you just send it over chat, it only lives on one laptop, and nobody knows who holds which value.
02
It only lives on one laptop
You lose track of where the latest value is and who actually has it.
03
No history, no recipient list
There is no record of who changed what and when, or who it is currently shared with.
02 · The solution
Solved inside your Git workflow
Not enough to justify a dedicated secrets management platform or a cloud Secrets Manager, but you want to stop handing out plaintext. Kapsaro fills that gap — no dedicated server or external SaaS.
Encrypted per member
Share without passwords
Secrets are encrypted to each member's public key, so there is no shared password to distribute. Ciphertext lives under .kapsaro/secrets/, keeping the plaintext .env out of the repository.
Reviewed in a PR
See changes and recipients
Both value changes and recipient updates show up as a diff in a pull request, on the same review flow as your code.
Inject into commands
Run without plaintext on disk
kapsaro run passes decrypted values to the process, leaving no plaintext file on disk.
03 · How it works
Three steps into your daily flow
Your application startup stays familiar. Only the decrypted values are passed as environment variables.
1
Initialize the project
You can use an existing Ed25519 SSH key, such as one already used with GitHub.
2
Import .env
Secrets are encrypted per key, so changed entries and signatures are the primary diff.
3
Run your usual command
Decrypted values are passed to the process, leaving no plaintext file on disk.
# 1. Initialize the workspace
kapsaro init --member-handle alice@example.com
# 2. Encrypt and import your existing .env
kapsaro import .env
# 3. Run without writing plaintext
kapsaro run -- npm start
# 4. Retrieve a single value
kapsaro get DATABASE_URL04 · Good fit
Built for teams like these
For teams that want to step out of plaintext sharing without changing their Git workflow. It is not a control plane for every production secret — pair it with a dedicated Secrets Manager or KMS where you need instant revocation, detailed audit logs, or dynamic secrets.
Dev & staging
Development and staging .env
Share the .env used locally or in staging without passing plaintext around.
Certificates
Certificates shared in a team
Distribute client certificates and key files in a traceable way.
CI
Scoped CI secrets
Manage narrowly scoped CI secrets through the same repository review.
Git-native
Keep your current flow
Run on your existing repository and PR review without adopting new infrastructure.
05 · Security
Security model
Kapsaro protects secrets with public-key cryptography — keyed per member — and proven, industry-standard algorithms. It does not rely on a custom cryptographic algorithm.
Per-user keys
No shared keys — only you decrypt
Secrets are encrypted with public-key cryptography, addressed to each recipient. There is no shared password or common key to hand around; only the registered owner can decrypt with their own key.
Standard crypto
Proven, industry-standard algorithms
Kapsaro uses published, widely vetted public-key encryption and signatures (such as HPKE and Ed25519) rather than homegrown cryptography.
No central server
No central server to breach
Encryption and decryption happen locally. The keys that can decrypt stay on each member's machine, and the repository holds only ciphertext — so there is no single place whose breach leaks all the plaintext.
06 · Getting started
All you need is an SSH key
If you already have an Ed25519 SSH key — the one you use with GitHub — you can start in your existing repository. No GPG, no dedicated server, no external SaaS. Install with Homebrew and import your existing .env.
# Homebrew
brew install ebisawa/kapsaro/kapsaro
# Initialize and import
kapsaro init --member-handle alice@example.com
kapsaro import .envAppendix · FAQ
FAQ
- Do I need GPG?
- No. Kapsaro uses Ed25519 SSH keys. GPG or PGP key management is not required.
- Do I need a cloud Secrets Manager?
- Not for everyday development and staging sharing. Encryption, decryption, and signature verification happen locally. For production needs like instant revocation, detailed audit logs, or dynamic secrets, pair Kapsaro with a dedicated Secrets Manager / KMS.
- Can Kapsaro manage all my production secrets?
- No. Kapsaro is not a central control plane for every production secret. For preventing exfiltration of decrypted values, instant revocation, detailed audit logs, or dynamic secret issuance, combine it with a dedicated Secrets Manager / KMS. Kapsaro makes everyday, Git-adjacent secret sharing safer.
- Can I migrate from an existing .env file?
- Yes.
kapsaro import .envimports it. After that, usekapsaro runorkapsaro get. - Can it encrypt files other than .env?
- Yes. Certificates, config files, and arbitrary binaries can be handled with
kapsaro encryptandkapsaro decrypt. - Can Kapsaro recover secrets from a removed member?
- No. A secret that was legitimately decrypted cannot be clawed back. Kapsaro records past disclosure so teams can decide which values need rotation.
- Is Kapsaro free?
- Yes. Kapsaro is open-source software under the Apache License 2.0. It is provided without warranty and used at your own risk.